{"id":1900,"date":"2026-09-03T20:10:04","date_gmt":"2026-09-03T20:10:04","guid":{"rendered":"https:\/\/cybercolombia.co\/index.php\/2026\/09\/03\/ceo-phishing-kits-5k-dropbox-account-hacks-oauth-traps-17-more-stories-cyberdefensa-mx\/"},"modified":"2026-09-03T20:10:04","modified_gmt":"2026-09-03T20:10:04","slug":"ceo-phishing-kits-5k-dropbox-account-hacks-oauth-traps-17-more-stories-cyberdefensa-mx","status":"publish","type":"post","link":"https:\/\/cybercolombia.co\/index.php\/2026\/09\/03\/ceo-phishing-kits-5k-dropbox-account-hacks-oauth-traps-17-more-stories-cyberdefensa-mx\/","title":{"rendered":"CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories \u2013 CYBERDEFENSA.MX"},"content":{"rendered":"
\n

The worst part is how normal these attacks look. A call from IT. A shared file. A trusted app. A simple request to click \u201cAllow.\u201d Why break in when someone might open the door?<\/p>\n

That idea runs through this edition. Attackers use real tools, fake login pages, old account links, and software guides that point to unsafe downloads. One wrong letter in a web address can be enough.<\/p>\n

There is also ransomware, stolen ID data, hidden attack servers, and weak settings that should have been fixed long ago. Here\u2019s the full list.<\/p>\n

\n <\/p>\n

The threats change every week. Subscribe, and we\u2019ll alert you<\/span> when each new ThreatsDay Bulletin is out.<\/p>\n<\/div>\n

\n
\n
    \n<\/p>\n
  1. \n
    Fake IT, Real Access<\/span> <\/p>\n

    Microsoft has warned of a human-operated intrusion campaign that leverages Microsoft Teams external collaboration to impersonate IT or help desk personnel and socially engineer users into granting an interactive remote session. \u00abOnce remote control is established via RMM tools, the threat actor uses PowerShell to download and silently install a malicious MSI package, which in turn stages a portable Node.js runtime and an obfuscated JavaScript implant that provides persistent command execution and command and control (C2),\u00bb the tech giant said<\/a>. \u00abAfter the implant is deployed, the threat actor performs extensive host and Active Directory reconnaissance, periodically captures screenshots of the victim\u2019s desktop, executes follow-on payloads through trusted Windows binaries, and pivots across the enterprise over Windows Remote Management (WinRM) toward high-value assets such as domain controllers.\u00bb Microsoft has described the \u00abintrusion pattern\u00bb as high-impact as it grants an external operator interactive access to internal infrastructure. <\/p>\n<\/div>\n<\/li>\n

  2. \n <\/p>\n
    \n Teams Vishing at Scale<\/span><\/p>\n

    \n In more Teams-related abuse, a coordinated social engineering operation dubbed Spring Ring has been observed leveraging external Microsoft Teams accounts to masquerade as IT help desk personnel to target more than 150 employees across at least 10 companies in various industries between January and April 2026. \u00abWhat seems like a benign chat is in fact a voice phishing (vishing) call, during which adversaries try to coerce victims into executing remote monitoring and management (RMM) tools or custom malware,\u00bb Palo Alto Networks Unit 42 said<\/a>. \u00abIn a more advanced variant, attackers transitioned from a vishing call to a full-blown Microsoft NT LAN Manager (NTLM) relay attack aimed at an organization\u2019s domain controller (DC).\u00bb As many as 26 distinct attacker identities have been identified behind the chat and call attempts.\n <\/p>\n<\/div>\n

    \"\"<\/a><\/div>\n<\/li>\n
  3. \n <\/p>\n
    \n Ransomware Affiliate Playbook<\/span><\/p>\n

    \n In a new report, Sophos revealed that The Gentlemen ransomware operation, which it tracks as Gold Sherwood, has claimed a total of 683 victims by the end of July 2026. In July alone, the group is said to have added 169 victims. \u00abThe Gentlemen ransomware intrusions [\u2026] demonstrate a repeatable affiliate playbook that combines opportunistic initial access, rapid privilege escalation, legitimate remote access mechanisms, tool staging in trusted system paths, targeted data exfiltration, aggressive defense evasion, backup disruption, and ransomware deployment,\u00bb Sophos said<\/a>. \u00abAffiliates are operationally flexible: they use native Windows utilities, commercial and open-source tools, BYOVD-based EDR killers, and backup service tampering to adapt to victims\u2019 environments and maximize impact before encryption.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  4. \n <\/p>\n
    \n PhaaS Survives Takedown<\/span><\/p>\n

    \n The Outsider phishing-as-a-service (PaaS) platform has continued to be a resilient threat in the face of law enforcement action that took down a number of domains related to the service. The kit is operated by a threat actor known as \u00abChenLun.\u00bb Group-IB said<\/a> it has identified over 700 new phishing pages created using the kit within a month after Google filed a civil lawsuit against its operators, indicating that affiliates are continuing to use the service. The campaigns are delivered via SMS. \u00abWhat was once a technically demanding operation has been reduced to a subscription and a Telegram channel,\u00bb Group-IB said. \u00abThe phishing kits are distributed via a dedicated Telegram ecosystem. Operators used a WebSocket connection for live keylogging and to manipulate MFA challenges.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  5. \n <\/p>\n
    \n Signed Software, Hidden Payload<\/span><\/p>\n

    \n A government-themed tax notice campaign is targeting recipients through U.A.E.- and India-themed tax assessment lures to persuade them to open a malicious disc image. \u00abThe disc image contains a legitimate, validly signed commercial executable alongside a hidden, unsigned malicious DLL,\u00bb iZOOlogic said<\/a>. \u00abThis makes abuse of software trust and DLL sideloading the central mechanism of the campaign. The malicious DLL acts as a loader and establishes multiple execution and persistence mechanisms. The loader contains three encrypted payloads. Two decrypt to legitimately signed kernel drivers from unrelated commercial products, while the third is a persistence script.\u00bb The attack chain paves the way for a Registry-resident second stage, which connects to an external server over UDP.\n <\/p>\n<\/div>\n

    \"\"<\/a><\/div>\n<\/li>\n
  6. \n <\/p>\n
    \n Executive Phishing as a Service<\/span><\/p>\n

    \n ZeroBEC has disclosed details of a turnkey phishing service called BlueKit that\u2019s being used to target CEOs of financial-industry groups to facilitate credential theft using a browser-in-the-middle (BitM<\/a>) infrastructure. The campaign uses document-sharing lures to trigger the attack chain and employs ZeroBot to screen bots. \u00abThe campaign did not stop at credential or session theft,\u00bb ZeroBEC said<\/a>. \u00abAfter a BlueKit browser-in-the-middle flow, selected victims were moved into a fake document-viewer workflow that delivered a legitimate ScreenConnect client configured for an attacker-used ScreenConnect cloud instance.\u00bb The service advertises access at $250 for seven days, $480 for 14 days, and $940 for 30 days, placing it at the higher end of the current PhaaS market, in comparison to Tycoon 2FA, Greatness, and Forg365, which cost approximately $350, $289, and $400 per month.\n <\/p>\n<\/div>\n

    \"\"<\/a><\/div>\n<\/li>\n
  7. \n <\/p>\n
    \n Dormant Domains, Ready C2<\/span><\/p>\n

    \n Cybersecurity researchers have analyzed the infrastructure powering the operations of Prince of Persia (aka Indy), a little-known Iranian hacking group known for deploying malware families, Foudre and Tonnerre, to profile victims and harvest sensitive data from high-value targets. According to Whisper Security\u2019s Kaveh Azarhoosh<\/a>, the backend is self-authoritative, with each live C2 server also running the nameservers for its own domains. Also identified is a dormant reserve of 58 domains that are registered and delegated to the group\u2019s own nameservers, but none of which currently points at any server. \u00abThey\u2019re staged, not live: the moment any one of them gains an address record, a new command server has gone live \u2014 and it\u2019s visible before the server does anything at all,\u00bb Azarhoosh told The Hacker News via email.\n <\/p>\n<\/div>\n<\/li>\n

  8. \n <\/p>\n
    \n Remote-Controlled Rubber Ducky<\/span><\/p>\n

    \n Intezer has detailed<\/a> a fake \u00abprivacy browser\u00bb downloaded from a counterfeit site (\u00abwww.mxsetuplogi.com\u00bb) that turns remote attacker commands into simulated mouse and keyboard input on a victim\u2019s machine. The site is surfaced via a sponsored search result on Google, in this case after the victim mistyped the domain name (\u00abwww.mxsetup.logi.con\u00bb) on the address bar. The cybersecurity company described it as a USB Rubber Ducky attack<\/a> delivered over the internet. \u00abThis attack evades EDR and sits at zero to two detections on VirusTotal,\u00bb it said in a statement. \u00abThe infection began with one simple mistyped letter during routine mouse setup that routed the victim through a malvertising network into an MSIX installer signed through Microsoft\u2019s own infrastructure.\u00bb The campaign has been tracked back to a similar operation<\/a> from January 2016, indicating that the activity has been active for at least a decade.\n <\/p>\n<\/div>\n<\/li>\n

  9. \n <\/p>\n
    \n 153 Million IDs for Sale<\/span><\/p>\n

    \n The U.S. Federal Bureau of Investigation (FBI) is investigating a new ID theft service called Nexus, which claims to have digital scans of over 153 million driver\u2019s licenses from people in the U.S. and Canada. According to independent security journalist Brian Krebs<\/a>, the service is said to be siphoning images collected by a widely used identity verification company called IDScan.net based in Louisiana. The service, launched on the dark web on August 31, 2026, also boasts of more than 10 million identification cards, more than three million travel documents and\/or international IDs, and at least 579,000 medical cards. Each record can be unlocked for $100. Shortly after the expos\u00e9 was published, Nexus went offline. IDscan.net is said to be investigating the incident on its end.\n <\/p>\n<\/div>\n<\/li>\n

  10. \n <\/p>\n
    \n AI Instructions Become a Trap<\/span><\/p>\n

    \n A scan of 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies has uncovered llms.txt or llms-full.txt<\/a> that are being placed at the root of their websites, alongside robots.txt. \u00abThe file is not a sitemap and it is not a disclaimer,\u00bb an Israeli stealth startup said. \u00abIt is a curated instruction set for AI agents: what to read, which APIs to call, which packages to install, which domains to trust. OpenAI, Anthropic, and Google publish their own.\u00bb Of the 8,265 llms.txt and llms-full.txt files<\/a> surfaced from the scan, 120 of them, each on a different site, featured install instructions pointing to PyPI or npm package names and domains that had never been registered. \u00abWe selected a small set of package names that appeared in the llms.txt files of companies you have definitely heard of, and registered them on PyPI and npm,\u00bb Alon Hertz, one of the researchers said<\/a>. \u00abInto each one we embedded a single phone-home \u2014 a minimal beacon that reported the fact of installation back to infrastructure we controlled. The first callback arrived in under four minutes.\u00bb What\u2019s troubling here is that at least one active attack has already exploited this misconfiguration, in which authentication vendor Clerk\u2019s llms.txt included a reference to an npm package named \u00abclerk-next-fix-auth-protection\u00bb instead of referencing its scoped package, @clerk\/eslint-plugin. An unknown threat actor registered a public package with the same name. The package contained code to transmit the installer\u2019s username, machine name, working directory, and timestamp to an external server. Clerk has since addressed the issue.\n <\/p>\n<\/div>\n<\/li>\n

  11. \n <\/p>\n
    \n AI Defenders Sound the Alarm<\/span><\/p>\n

    \n A coalition of over 100 companies, including Anthropic, Google, OpenAI, Microsoft, Perplexity, and others, has published an open-leet calling for improvements to cybersecurity as AI continues to compress compress cyberattack timelines, as well as accelerate the speed and scale of cyber attacks, leaving defenders with an ever-shortening window to address security issues before they are exploited. The signatories noted that current approaches to cybersecurity are not equipped to deal with the incoming surge in AI-enabled attacks, and that threat actors can rely on AI tools to target longstanding vulnerabilities, excessive permissions, misconfigurations, insecure and unpatched software, weak authentication, and technical debt in legacy systems. \u00abIn the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable,\u00bb the letter warns<\/a>. \u00abThe companies and public services our communities depend on \u2013 from hospitals to water treatment plants to the infrastructure that powers the internet \u2013 are at risk. Today\u2019s AI advances are already giving defenders new ways to fix weaknesses that have accumulated for years. If we act decisively, we can use the defenders\u2019 window to make our digital world much more secure.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  12. \n <\/p>\n
    \n Legacy Login Exposes 5K Accounts<\/span><\/p>\n

    \n Dropbox has disclosed that about 5,000 accounts were compromised last month, allowing threat actors to view and download content stored on the cloud-storage \u200c platform. The company told<\/a> Reuters that it \u00abidentified unauthorized access \u200baffecting accounts linked to a Lenovo ID \u200bthat did not have its two-factor authentication enabled,\u00bb adding it terminated all sessions authenticated through a Lenovo ID. Lenovo said the issue is related to a \u00ablegacy \u2060integration\u00bb between Lenovo ID and Dropbox that \u00abcould be used to improperly authenticate certain Dropbox accounts.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  13. \n <\/p>\n
    \n Kernel Protection by Default<\/span><\/p>\n

    \n Microsoft has announced<\/a> that it will expand memory integrity protection across eligible devices starting October 2026, to help users benefit from \u00abstronger kernel-level protection from sophisticated attacks by default with little or no additional configuration.\u00bb The company continued: \u00abThis change reduces security complexity while helping you establish a stronger security baseline across your environment. Built on Virtualization-based Security (VBS), memory integrity helps protect critical parts of Windows from tampering. It forms a foundation for modern security innovations such as hotpatch updates that improve user experience and productivity, as well as protection.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  14. \n <\/p>\n
    \n Pro-Ukraine Ransomware Rebrand<\/span><\/p>\n

    \n A new ransomware group named VantaCore<\/a> has targeted at least seven Russian companies with a proprietary ransomware strain and demanding millions of dollars in ransom. The threat actor is assessed to be a rebranding of a known pro-Ukrainian group tracked as Thor, F6 said. Also put to use in the attacks are VantaCoreLoader, to distribute the ransomware and other malicious programs, VantaCoreRAT, a backdoor that can harvest information about infected systems and execute commands, and SnowKiller, which can terminate security software using the BYOVD technique.\n <\/p>\n<\/div>\n<\/li>\n

  15. \n <\/p>\n
    \n Sextortion Suspects Face Life<\/span><\/p>\n

    \n Two Nigerian nationals, Adebola Festus Adekunle, 26, and Mudasiru Afeez Olawale, 24, have been extradited<\/a> to the U.S. to face prosecution in two separate cases for the financially-motivated sextortion of minors that led to the death of minors in both the Northern District of Mississippi and the Middle District of North Carolina. Both of them face a maximum penalty of life in prison and mandatory minimum prison sentences, with the child exploitation resulting in death charge carrying a minimum penalty of 30 years in prison.\n <\/p>\n<\/div>\n<\/li>\n

  16. \n <\/p>\n
    \n Hardware-Backed Digital IDs<\/span><\/p>\n

    \n Google said<\/a> it\u2019s expanding the Android Ready SE initiative to bring together silicon vendors, device manufacturers, wallet developers, and government issuers to streamline compliance and scale certified hardware security across the mobile ecosystem. The development is seen as a way to scale high-assurance, tamper-resistant digital identity amid accelerating global demand for securely storing national electronic IDs (eIDs) and mobile driver licenses (mDLs) in hardware-backed mobile wallets.\n <\/p>\n<\/div>\n<\/li>\n

  17. \n <\/p>\n
    \n OAuth Access Outlives Passwords<\/span><\/p>\n

    \n The FBI has warned that malicious cyber actors have been targeting prominent victims, their family members, and personal acquaintances by directly messaging personal accounts with malicious links leveraging a technique called OAuth consent phishing to gain access to their accounts. The activity has targeted government officials, media, and other publicly known personalities on a commercial messaging application (CMA), urging them to access a malicious link under the guise of a file-sharing service through an application under the malicious actor\u2019s control. \u00abPrevious phishing campaigns have also impersonated event coordinators and planners, who sent malicious links to targets under the guise of an invitation to an event and the need to verify the target\u2019s identity through a malicious application under the actor\u2019s control,\u00bb the FBI said<\/a>. Authorities did not provide any details about how many people may have been compromised by these attacks, or who is behind them.\n <\/p>\n<\/div>\n

    \"\"<\/a><\/div>\n<\/li>\n
  18. \n <\/p>\n
    \n Electron Apps Hide a Stealer<\/span><\/p>\n

    \n Trojanized Electron desktop applications impersonating legitimate software are being used to distribute a Windows information stealer called RevStealer. The applications are shared via GitHub repositories and game-cheat-themed sites, including a fake Claude Opus 5 Free Desktop project. \u00abIt is delivered by an Electron loader that hides an AES-encrypted native payload inside an application resource, attempts to add the user\u2019s AppData folder to Microsoft Defender\u2019s exclusion list, and launches the payload with no visible window,\u00bb Morphisec said<\/a>. The malware also runs a series of anti-analysis and anti-VM checks before unpacking the main payload. \u00abIf the primary C2 is unreachable, RevStealer reads a fallback address from a smart contract on the Polygon blockchain, letting operators rotate infrastructure without rebuilding the malware,\u00bb the company said. What\u2019s notable about the malware is that it\u2019s not designed for persistence. Rather, it prioritizes capturing as much data as possible in a single run, exfiltrates it in encrypted typed records, and then deletes itself.\n <\/p>\n<\/div>\n<\/li>\n

  19. \n <\/p>\n
    \n Trusted Tool, Rogue Access<\/span><\/p>\n

    \n Threat actors are weaponizing Faronics Deploy, a legitimate endpoint management platform, to run attacker-controlled PowerShell after phishing victims install the software. Huntress said it observed more than 457 endpoints encountering Faronics-related lures. \u00abIn observed cases, threat actors chained Faronics Deploy to ScreenConnect, blending malicious remote access activity into trusted software workflows,\u00bb it said<\/a>. \u00abThe delivery method varies between scripts, with observed examples using curl or MSHTA to retrieve additional content, while others invoke msiexec to install payloads hosted on attacker-controlled infrastructure. These scripts are subsequently used to install ScreenConnect, establishing an additional remote access mechanism on the compromised endpoint.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  20. \n <\/p>\n
    \n ClickFix Goes Cross-Platform<\/span><\/p>\n

    \n Cybersecurity researchers have described CRPx0 as a ClickFix-delivered ransomware-as-a-service (RaaS) operation that employs lures related to Windows and macOS update prompts and reCAPTCHA checks to trick victims into running a copied command. \u00abOn Windows, it starts a multi-stage DLL chain. On macOS, it downloads the Python payload directly,\u00bb the Ransom-ISAC Research Team said<\/a>. \u00abThe final payload is a cross-platform Python ransomware that exfiltrates data before encryption, encrypts files with AES-128-CBC via Fernet, wraps the per-victim key with an embedded RSA-4096 public key, attempts lateral movement, and drops ransom notes demanding Bitcoin or Monero payment within 48 hours.\u00bb The RaaS program first appeared on June 7, 2026. As of late August, the group has advertised the operation on a clearnet site (\u00abcrpx0[.]su\/v3.txt\u00bb) as an offensive control panel to manage compromised machines, harvest files and credentials, monitor stolen cryptocurrency artifacts, run remote commands, and launch ransomware manually.\n <\/p>\n<\/div>\n<\/li>\n<\/ol>\n<\/section>\n<\/div>\n

    One point is easy to miss: changing a password may not shut every door. A bad app approval or remote session can give attackers access without the password. Recovery should also end open sessions, remove unknown app access, and check remote tools.<\/p>\n

    Better security settings are slowly becoming the default, which helps. But old account links, weak sign-in options, and trusted software still give attackers room to work. The safest rule this week is simple: check what already has access before adding anything new.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    The worst part is how normal these attacks look. A call from IT. A shared file. A trusted app. A simple request to click \u201cAllow.\u201d Why break in when someone might open the door? That idea runs through this edition. Attackers use real tools, fake login pages, old account links, and software guides that point […]<\/p>\n","protected":false},"author":1,"featured_media":1901,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,5],"tags":[2969,4212,24,4213,2206,1317,360,365,23,19],"class_list":["post-1900","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-noticias","category-trending","tag-account","tag-ceo","tag-cyberdefensa-mx","tag-dropbox","tag-hacks","tag-kits","tag-oauth","tag-phishing","tag-stories","tag-traps"],"_links":{"self":[{"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/posts\/1900","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/comments?post=1900"}],"version-history":[{"count":0,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/posts\/1900\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/media\/1901"}],"wp:attachment":[{"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/media?parent=1900"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/categories?post=1900"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/tags?post=1900"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}